Triaging Incidents

Triaging ServiceNow Incidents

Create, triage, investigate, and analyze incidents. See references/incident-fields.md for the priority matrix, states, categories, and encoded query patterns.

Workflows

1. List Recent Incidents

Get a summary of recent incidents by priority, state, or assignment group.

Progress checklist (copy into your response):

- [ ] Query incidents with filters
- [ ] Summarize by priority and state
- [ ] Highlight critical/P1 incidents

1. List recent incidents (last 24 hours, open):

`` list_records(table_name="incident", query="active=true^sys_created_on>=javascript:gs.daysAgoStart(1)", fields="number,short_description,priority,state,assignment_group,assigned_to,sys_created_on", limit=20, order_by="-priority") ``

1. For a specific assignment group:

`` list_records(table_name="incident", query="active=true^assignment_groupLIKE", fields="number,short_description,priority,state,assigned_to", limit=20) ``

1. Summarize: total count, breakdown by priority (P1/P2/P3/P4), breakdown by state, highlight any P1/P2 incidents.

2. Triage a New Incident

Assess impact and urgency, then suggest priority, category, and assignment group.

Progress checklist:

- [ ] Get incident details
- [ ] Assess impact and urgency
- [ ] Check affected CI and its dependencies
- [ ] Suggest priority, category, assignment group
- [ ] Recommend next steps

1. Get the incident details:

`` get_record(table_name="incident", sys_id="") ``

1. If a CI is attached, check its relationships to assess blast radius:

`` get_ci(sys_id="") get_ci_relationships(sys_id="") ``

1. Look for similar recent incidents (same CI or category):

`` list_records(table_name="incident", query="cmdb_ci=^sys_created_on>=javascript:gs.daysAgoStart(30)", fields="number,short_description,state,priority", limit=10) ``

1. Recommend triage decisions:

• Priority: Based on impact x urgency matrix (see references/incident-fields.md)
• Category: Based on the affected CI class and description keywords
• Assignment group: Based on CI ownership or category routing rules

1. Present recommendations with reasoning.

3. Investigate an Incident

Deep-dive into an existing incident — full context, related CIs, similar incidents.

Progress checklist:

- [ ] Get full incident details
- [ ] Get affected CI details and relationships
- [ ] Find similar recent incidents
- [ ] Check for related problems or changes
- [ ] Summarize findings and recommend actions

1. Get the full incident record:

`` get_record(table_name="incident", sys_id="") ``

1. If a CI is attached, get its details and dependency chain:

`` get_ci(sys_id="") get_ci_relationships(sys_id="") ``

1. Find similar recent incidents:

`` list_records(table_name="incident", query="categoryLIKE^sys_created_on>=javascript:gs.daysAgoStart(30)", fields="number,short_description,state,priority,resolution_notes", limit=10) ``

1. Check for related problems:

`` list_records(table_name="problem", query="cmdb_ci=^active=true", fields="number,short_description,state", limit=5) ``

1. Check for recent changes on the same CI:

`` list_records(table_name="change_request", query="cmdb_ci=^sys_created_on>=javascript:gs.daysAgoStart(7)", fields="number,short_description,state,type", limit=5) ``

1. Summarize: incident context, CI dependency impact, related incidents/problems/changes, recommended actions.

4. Create an Incident

Create a new incident with validated fields and appropriate defaults.

Progress checklist:

- [ ] Validate required fields are provided
- [ ] Suggest category from description
- [ ] Set appropriate defaults (state, priority)
- [ ] Create the incident
- [ ] Confirm creation with INC number

1. Validate required fields: short_description is mandatory. Confirm caller_id is provided.
2. Suggest category based on description keywords (see references/incident-fields.md).
3. Set defaults for missing fields:

• state: 1 (New)
• impact: 3 (Low) unless specified
• urgency: 3 (Low) unless specified
• priority is auto-calculated from impact x urgency

1. Create the incident:

`` create_record(table_name="incident", data={"short_description": "...", "description": "...", "caller_id": "...", "category": "...", "impact": "3", "urgency": "3", "cmdb_ci": "..."}) ``

1. Confirm creation: return the INC number, priority, and link.

5. Bulk Analysis

Analyze incident trends — top categories, repeat offenders, SLA status.

Progress checklist:

- [ ] Pull recent incidents (7-30 day window)
- [ ] Group by category
- [ ] Identify repeat CIs (frequent flyers)
- [ ] Check SLA breaches
- [ ] Present trends and recommendations

1. Pull recent incidents:

`` list_records(table_name="incident", query="sys_created_on>=javascript:gs.daysAgoStart(30)^active=true", fields="number,category,cmdb_ci,priority,state,assignment_group,sla_due", limit=100, order_by="-sys_created_on") ``

1. Group by category — which categories generate the most incidents?
2. Identify repeat CIs — which CIs appear in multiple incidents?

`` list_records(table_name="incident", query="cmdb_ci=^sys_created_on>=javascript:gs.daysAgoStart(30)", fields="number,short_description,priority,state", limit=20) ``

1. Check for SLA breaches:

`` list_records(table_name="incident", query="active=true^sla_due", fields="name,sys_id").

• See references/incident-fields.md for encoded query patterns and field reference.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: jschuller
• Source: jschuller/mcp-server-servicenow
• License: MIT

Install and usage instructions live in the source repository linked above.